Customized, cloud-based data collection tool

ABSTRACT

An approach is provided for generating a customized, cloud-based data collection tool for collecting data from computer resources of a target system. In an embodiment, the method comprises: receiving a request to perform a data collection from one or more target computer resources; wherein the request includes one or more requirements that are specific to the data collection; based on, at least in part, the requirements, generating a customization specification for generating a customized collector that is specific to the data collection to be performed on the target computer resources; and transmitting the customization specification to a deployment engine to cause the deployment engine to: based on, at least in part, the customization specification, generate the customized collector that is specific to the data collection to be performed on the target computer resources; and transmit the customized collector, for generating the customized collector, to a cloud storage for storing.

FIELD

Embodiments relate generally to collecting electronic data from targetdevices.

BACKGROUND

The approaches described in this section are approaches that could bepursued, but not necessarily approaches that have been previouslyconceived or pursued. Therefore, unless otherwise indicated, theapproaches described in this section may not be prior art to the claimsin this application and are not admitted as prior art by inclusion inthis section.

Current approaches for collecting electronic data from target systemshave many shortcomings. For example, some collection systems need to bemanually installed on the target systems. This may raise concerns aboutthe integrity and security of the collected data. Also, installing somecollection systems may be performed only by system administrators whohave specialized knowledge, and such administrators may be unavailablein some situations. This may raise concerns about the efficiency of thedata collection process.

Some electronic discovery (eDiscovery) systems collect all data residingon target computer resources even if certain data residing on theresources is neither requested nor desired. Relying on such systems mayimpede achieving proportionality between the cost of the eDiscovery andthe amount of damages sought by the claimants.

Some eDiscovery systems are configured to store collected data only innon-cloud-based storage systems that usually have limited accessibilityand capacity. Such systems also offer limited portability.

SUMMARY

An approach is provided for collecting data from computer resources of atarget system. In an embodiment, one or more non-transitorycomputer-readable storage media store instructions which, when processedby one or more processors, cause receiving a request to perform a datacollection on one or more target computer resources. The requestincludes one or more requirements that are specific to the datacollection to be performed on the target computer resources.

Based on, at least in part, the request, a customization specificationfor creating a customized collector is generated. As used herein, theterm “customization specification” refers to data that defines one ormore attributes of a collection to be performed. According to oneembodiment, a customization specification is used to generate acustomized collector, as described in more detail hereinafter.Customization specification, also referred to as customizationspecification data, includes data that describes what, from where, andhow is to be collected. The customization specification data provides arecipe for generating and customizing the customized collector. Thecustomization specification may specify for example, file types of datato be collected, target computer resources from which the data is to becollected, a time zone for collecting the data, a case name, a chunksize, an expiry date, a signature analysis indicator, a parse/compressindicator, a parse email indicator, local disks indicators, removabledisks indicators, and/or mapped network shares indicators.

The customization specification is transmitted to a deployment engine tocause the deployment engine to generate the customized collector. Thecustomized collector is generated based on, at least in part, thecustomization specification. The customized collector is specific to thedata collection to be performed on the target computer resources. Thecustomized collector is transmitted to a cloud storage for storing.

A custodian of the target computer resources downloads the customizedcollector onto a collector computer, and initiates execution of thecustomized collector to perform the data collection from the targetcomputer resources. Executing the customized collector includescollecting data that is specified by the customization specification.

BRIEF DESCRIPTION OF THE DRAWINGS

In the figures of the accompanying drawings like reference numeralsrefer to similar elements.

FIG. 1 is a block diagram that depicts an example arrangement for acloud-based data collection system architecture.

FIG. 2A is a block diagram that depicts example services provided by adeployment server.

FIG. 2B is a block diagram that depicts example services provided by acustomized collector.

FIG. 2C is a block diagram that depicts example services provided by acustodian computer.

FIG. 3 is a block diagram that depicts an example customizationspecification.

FIG. 4 is a block diagram that depicts an example approach forcollecting data from a target system using a customized, secure,cloud-based data collection tool.

FIG. 5 is a flow diagram that depicts an example approach for collectingdata from a target system using a customized, secure, cloud-based datacollection tool.

FIG. 6 is a block diagram of a computer system on which embodiments maybe implemented.

DETAILED DESCRIPTION

In the following description, for the purposes of explanation, numerousspecific details are set forth in order to provide a thoroughunderstanding of the present approach. It will be apparent, however, toone skilled in the art that embodiments may be practiced without thesespecific details. In other instances, well-known structures and devicesare shown in block diagram form in order to avoid unnecessarilyobscuring the embodiments. Various embodiments are described hereinafterin the following sections:

I. OVERVIEW

II. CLOUD-BASED DATA COLLECTION SYSTEM ARCHITECTURE

A. Requestor Computer

B. Deployment Server

C. Deployment Engine

D. Cloud-Based Storage

E. Target System

III. EXAMPLES OF DATA COLLECTION SERVICES

A. Example Services Provided by a Deployment Server

B. Example Services Provided by a Collector

C. Example Services Provided by a Custodian Computer

IV. EXAMPLE COLLECTOR

A. Example Customization Specification

B. Examples of Customized Collectors

V. EXAMPLE PROCESS FOR A CLOUD-BASED DATA COLLECTION

VI. EXAMPLE WORKFLOW FOR A CLOUD-BASED DATA COLLECTION

VII. BENEFITS OF CERTAIN EMBODIMENTS

VIII. IMPLEMENTATION MECHANISMS

I. Overview

An approach is provided for a customized, secure, cloud-based datacollection system that improves the process of collecting electronicdata from target systems. The approach may be implemented in a datadiscovery application configured to perform the electronic datadiscovery. The examples included herein are provided merely for thepurpose of explaining some implementations, and are not to be viewed aslimiting the scope of the presented approach. For instance, the examplespresented herein in the context of legal discovery or in the context ofan audit process are not to be viewed as limiting in any way.

In an embodiment, an approach for a cloud-based data collection systemimproves the process of collecting electronic data from a target systemby generating a customized collector for collecting specific data fromspecific resources of a target system. The collector may be customizedto the target system and to the type of data that is to be collectedfrom the target system.

In an embodiment, a deployment service generates a customizationspecification for a customized collector, and sends the customizationspecification to a deployment engine. Upon receiving the customizationspecification, the deployment engine uses the specification to generatethe customized collector. The customized collector is specific to thecomputer resources of the target system. Customizing the collector andproviding the customized collector to a custodian of the target systemallows collecting only the requested data, and collecting the data inthe way that is customized to the configuration of the target resourcesof the custodian.

As the customized collector is executed on the target system, only thedata that meets the customization criteria is collected, and only theresources that meet the customization criteria are searched. Once thecollector finishes the data collection, the collected data is encryptedand stored in a cloud-based storage system. Once the data collection iscompleted, the collection requestor is notified and provided with theinformation about a location, on the cloud-based storage system, wherethe encrypted, collected data is stored.

The customization allows specifying the types of data that are required.This allows avoiding situations in which more data is collected from thetarget systems than is needed, and in which the cost of collecting thedata from the target systems becomes unreasonably high in light of thedamages that are sought. For example, if the requested damages arerelatively high, then the scope of the discovery may be relatively broadand comprehensive. However, if the requested damages are relatively low,then the scope of the discovery may be relatively narrow andspecialized.

The approach also improves the accessibility of discovery processes byproviding an enhanced user interface for customizing a collector. Thismay include providing a user interface that has extensivefunctionalities for determining types of data to be collected, targetresources from which the data is to be collected, storages on which thecollected data is to be stored, and types of reports to be preparedbased on the collected data.

Furthermore, the approach allows engaging an independent data collectionservice to perform data collection in a secure and autonomous manner.For example, a deployment server and a deployment engine may be used togenerate and deploy a secure collector that is customized to collectdata from a target system. Both the deployment server and the deploymentengine may remain independent from the parties and the law suit betweenthe parties.

The customized collector may be secured with a unique, one-time key thata custodian of the target system is expected to use to download thecollector from the cloud storage. Once the collector is successfullydownloaded to the target system, the collector is installed andinitiated for execution.

A unique deployment key may be provided to a custodian separately fromproviding the customized collector or a hyperlink to the customizedcollector. The key may be provided to the custodian separately fromproviding the email notifying the custodian that the collector isavailable for downloading. The key may be provided via email, orverbally; for example, over the phone. The key may also be provided viaa letter. Providing the deployment key to the custodian separately fromproviding the collector affords an additional security measure that maybe unavailable if the customized collector and the key are provided inone communication. For example, the likelihood of success ofintercepting two separate emails (one with a hyperlink to the collectorand another with the key) is lower than the likelihood of success ofintercepting one email that includes both the link and the key.

Furthermore, providing the link and the key separately requires that thecustodian makes a more significant effort in parsing and using theinformation than if the key and the link were provided in onecommunication. If the key and the link are provided separately, then thecustodian needs to identify for example, two separate emails in hisemail inbox, extract the key from one of the emails, extract the linkfrom another email, use the link to access the collector, and then usethe key to authenticate himself to the collector.

An approach presented herein allows improving the process of collectingelectronic data from target systems in many ways. For example, itenhances the process of eDiscovery while maintaining proportionalitybetween the cost of the discovery and the amount of damages beingsought. By taking into consideration the amount of damages indetermining the scope of the discovery, the cost of the discovery may betailored to the amount that is reasonable to the involved parties. Thisallows avoiding situations where the cost of the legal discovery isdisproportionally high to the amount of damages.

Moreover, the approach improves the accessibility of collectors andcollected data. For example, the approach may be configured to utilizeany type of storage media, including cloud-based storages. For example,a customized collector may be stored in a cloud-base storage system. Thecollector may be available for downloading form the cloud storage to thetarget system. Once the requested data is collected, the collected datamay also be stored in the cloud storage.

Furthermore, the approach improves the reporting and analyzingcapabilities of the eDiscovery processes. For example, it allowsgenerating various types of reports based on the data collected andstored in cloud-based systems.

II. Cloud-Based Data Collection System Architecture

FIG. 1 is a block diagram that depicts an example arrangement for acloud-based data collection system architecture. In FIG. 1, arrangement100 includes a requestor computer 110, a deployment server 120, adeployment engine 130, a cloud storage 140, and a target system 150.

Example arrangement 100 may be implemented in computer systemsconfigured to perform any type of electronic data discovery. Theexamples included herein are provided merely for the purpose ofexplanation of example implementations, and are not to be viewed aslimiting the implementation scope of arrangement 100.

Requestor computer 110, deployment server 120, deployment engine 130,cloud storage 140, and target system 150 may be part of one or morecommunications networks and may be communicatively coupled with eachother via various communications links. The types and configurations ofthe networks and links may vary, and may depend upon the implementation.Communications links may be established across any number ofcommunications networks such as, for example, one or more Local AreaNetworks (LANs), Wide Area Networks (WANs), Ethernet networks or theInternet, and/or one or more satellite or wireless links.

Example arrangement 100 may include various types of communicationslinks 112, 114, 122, 132, 134, 142, 157, used to facilitatecommunications between requestor 110, deployment server 120, deploymentengine 130, cloud storage 140, and target system 150.

A. Requestor Computer

Requestor computer 110 is a computer-based-system that may beimplemented in hardware, computer software, or any combination ofhardware and computer software. Requestor computer 110 may host variousapplications and store electronic document data that includes structureddata and unstructured data.

Requestor computer 110 may be any type of client computer system ordevice. It may include one or more processors, and one or more memoryunits, including volatile memory and non-volatile memory. It may alsoinclude a display system and a storage system. Examples of clientdevices include personal or laptop computers, workstations, tabletcomputers, personal digital assistants (PDAs), and telephony devicessuch as smart phones. Requestor computer 110 may host softwareapplications, such as Web browser applications, graphical user interfaceapplications, and the like.

Requestor computer 110 may be implemented in a mobile device, such as asmart phone, a tablet, a portable computer, and the like. A mobiledevice implementing requestor computer 110 may be configured toestablish a wireless communications connection with deployment server120, and use the connection to submit collection requests to deploymentserver 120 and to receive notifications, updates and reports fromdeployment server 120.

Requestor computer 110 may be configured to receive requests forcollecting data from target system 150. Requestor computer 110 may beconfigured to provide a user interface for providing and customizing therequest for collecting data. The requests may be communicated fromrequestor computer 110 to deployment server 120. The requests mayspecify types of data to be collected from target system 150, timestampsthat the collected data needs to have associated, file extension of thecollected data, types of storages from which data is to be collected,email addresses for which data is to be collected, names of cases ormatters for which data is to be collected, and the like. Examples ofcustomization specifications for collecting data are described in FIG.3.

Requestor computer 110 may be configured to receive notifications andupdates pertaining to data collections. For example, requestor computer110 may receive a confirmation that a request for collecting particulardata from target system 150 was received, or a notification that acollection of the particular data from target system 150 has started.Furthermore, requestor computer 110 may receive a notification that therequested particular data has been collected from target system 150 andstored in cloud storage 140.

Requestor computer 110 may be configured to request and receive reportspertaining to data collections. The reports may include, for example,results of a data analysis of the collected data, results of statisticalanalysis of the collected data, and the like. Requestor computer 110 mayalso be configured to provide tools and user interfaces for requestingcustomized reports and for customizing the content and appearance of thereports.

B. Deployment Server

Deployment server 120 is a computer-based-system used to receiverequests for collecting data from one or more target systems 150.Deployment server 120 may be any type of client device, such as apersonal computer, a laptop computer, a workstation, a tablet computer,a personal digital assistant (PDA), a smart phone, and the like.Deployment server 120 may host software applications including forexample, Web browsers. Deployment server 120 may include a userinterface, one or more processors and memory units, including volatilememory and non-volatile memory. Examples of services that may beprovided by deployment server 120 are described in FIG. 2A.

Deployment server 120 may be implemented in a mobile device. Forexample, data deployment server 120 may be implemented in a smart phone,a tablet, a portable computer, and the like. A user of the mobile devicemay invoke an application residing on the mobile device, and use theapplication to receive requests for collecting electronic data fromtarget system 150.

C. Deployment Engine

Deployment engine 130 is a computer-based-system that is communicativelycoupled with deployment server 120 and cloud storage 140 via wirelessand/or wired communications links. Deployment engine 130 may beconfigured to receive instructions from deployment server 120. Uponreceiving the instructions, deployment engine 130 may generate a secure,customized collector, and store the collector according to the receivedinstructions. For example, upon receiving instructions from deploymentserver 120, deployment engine 130 may use the instructions to generate acollector, determine a location for storing the collector, and use thedetermined location to store the collector as a collector 140A in cloudstorage 140.

D. Cloud Storage

Cloud storage 140 is a computer-based storage system implemented in thecloud. Cloud storage 140 provides storage services for maintaining,managing, and backing-up data, and for making the stored data availableto users via communications connections. Access to the data stored incloud storage 140 is usually secured with passwords, and the data isusually encrypted. Cloud storage 140 may be configured to store forexample, collector 140A and collected data 140B.

Cloud storage 140 may be implemented in one or more computing devicesconfigured to store data and data files on one or more servers. Forexample, cloud storage 140 may be implemented in devices such asmagnetic disks, optical disks, and the like.

Cloud storage 140 may be configured to store information received fromrequestor computer 110, deployment server 120, deployment engine 130,and target system 150, and to make the stored information available tothe above entities.

E. Target System

Target system 150 may be configured to store user data, system data,email data, and any other type of electronic data. Target system 150 isa computer-based-system from which some data is collected as a collectoris executed.

Target system 150 may be configured as a multi-unit computer system thatincludes a plurality of computer devices communicatively coupled witheach other via wireless and/or wired communications links. Examples ofcomputer devices may include workstations 151-152, a tablet computer, aPDA 154, a data server 156, a database storage system 158, a smartphone, and the like. Target system 150 may host software applicationssuch as Web browsers and data processing applications, email serverapplications, and the like. While FIG. 1 depicts only a few examples ofuser devices that may be included in target system 150, other computerdevices and systems may also be included in target system 150.

Custodian workstation 151 of target system 150 is a workstation that isused by a custodian of target system 150. A custodian of a target systemin the context of collecting data from the target system is a person whois responsible for managing and maintaining one or more computerresources in target system 150, and who is responsible for downloading,installing and initiating execution of a collector on target system 150.The custodian of target system 150 may be for example, an owner oftarget system 150, a system administrator of the computer devicesincluded in target system 150, or a service provider that managescomputer resources of target system 150.

III. Examples of Data Collection Services

A. Example Services Provided by a Deployment Server

FIG. 2A is a block diagram that depicts example services provided bydeployment server 120. The example services described in FIG. 2A areprovided to illustrate certain examples, not to exhaust the list ofservices that deployment server 120 may provide.

The example services may include managing requests, notifications,updates and reports related to data collections. Requests may includethe requests received from requestor computer 110 and may pertain torequesting particular data from target system 150. Notifications mayinclude confirmation that collection requests have been received, thatdata collection has started, that data collection has been finished,that the collected data has been stored in cloud storage 140, and thatthe collected data is available to a requestor.

The example services may also include determining customizationrequirements for a data collection. The requirements may be providedfrom requestor computer 110, or may be entered via a user interfaceimplemented in deployment server 120.

The services provided by deployment server 120 may also includegenerating a customization specification for a customized collector. Forexample, upon receiving customization requirements for a datacollection, deployment server 120 may use the received customizationrequirements to generate a customization specification for creating acustomized collector. Deployment server 120 may be configured to specifyfile types to be searched, sources to be searched, whether, or which,attachments are to be searched, and whether legal forms, such as courtorders and other legal documents, are to be included in the legaldiscovery. Furthermore, deployment server 120 may be configured tospecify storage types that are to be searched, and storage locationsthat are to be searched or used to store collected data and data files.

Deployment server 120 may also be configured to retrieve and provideuser credentials, group credentials, and other authenticationinformation to be used by a collector to perform a data collection.Furthermore, deployment server 120 may be configured to specify timeconstrains for performing legal discovery tasks, types of processing,types of modifications (if any), methods of communicating results oflegal discovery, email addresses to be used by collector 140A and/or acustodian, types of notifications, error handling procedures, and thelike.

Moreover, deployment server 120 may be configured to specify a hyperlinkto cloud storage 140 for storing collector 140A, and specify anexecution environment for executing collector 140A.

The services provided by deployment server 120 may also includeproviding feedback to requestors who provided requests for datacollections. For example, deployment server 120 may generatenotifications to the requestors when the corresponding collectors havebeen deployed and when the requested data has been collected and storedin cloud storage 140.

The services may also include providing one-time access keys to acustodian of target system 150 to allow the custodians to download,install, and initiate collectors on target system 150. Alternatively,the key may be generated by deployment engine 130.

The services may further include providing reports pertaining to thecollected data. For example, deployment server 120 may generate andprovide a graphical user interface to requestors who requested datacollections, and allow the requestors to customize and request datareports that summarize information about the collected data.

B. Example Services Provided by a Collector

FIG. 2B is a block diagram that depicts example services provided bycollector 140A. The example services described in FIG. 2B are providedto illustrate certain examples, not to exhaust the list of services thatmay be provided by collector 140A.

Collector 140A is usually executed on target system 150 to collectparticular data stored at particular resources of target system 150.Collector 140A is usually downloaded and installed on target system 150once a custodian provides a unique, one-time deployment key. The key maybe provided to the custodian by either deployment server 120 ordeployment engine 130.

Example services provided by collector 140A include collecting data fromtarget system 150 according to a customization specification. Theservices may also include encrypting the collected data and storing theencrypted, collected data in cloud storage 140.

Collector 140A may also be configured to accept requests for generatingreports pertaining to the collected data, and to generate the requestedreports.

C. Example Services Provided by a Custodian Computer

FIG. 2C is a block diagram that depicts example services provided bycustodian computer 151. The examples depicted in FIG. 2C are to beviewed as non-limiting examples of the custodian services.

Custodian computer 151 may receive requests for providing credentialsfor access to resources of target system 150. For example, the custodianof target system 150 may be asked to provide access credentials foraccessing the user's data stored on devices of target system 150. Thecredentials for accessing system data stored on devices of target system150 may be used to generate a customized collector, and to allow thecollector to access the resources of target system 150.

Custodian computer 151 may also receive one-time, unique deployment keysfor accessing and installing collector 140A, and requests fordownloading collector 140A onto computer systems of target system 150.

Upon receiving a notification about a legal discovery request, acustodian may be asked for example, to provide the one-time unique keyto access collector 140A, and select an indicated hyperlink to downloadcollector 140A onto computer resources of target system 150.

The services may also include initiating an execution of collector 140Aon computer resources of target system 150. For example, a custodian maybe provided with instructions for starting collector 140A once thecollector is downloaded onto target system 150.

Collection of data from target system 150 may include collecting varioustypes of data, including data files having specific types, hosted byspecific devices, and residing in specific directories. For example, thecollection may include collecting data files that are JPG image fileshosted by workstation 152.

In an embodiment, identifying data that have specific types is performedbased on unique signatures that are embedded in data files. Using uniquesignatures to identify the files to be collected is more reliable thanusing file extensions included in the file names because the fileextensions may not necessarily correspond to the actual type of thefile. Relying on the file signatures allows a more accurate selection ofthe files for the collection than selecting the files based on the fileextensions.

IV. Example Collector

A. Example Customization Specification

FIG. 3 is a block diagram that depicts an example customizationspecification 300. Example customization specification 300 is used togenerate collector 140A, and it specifies the capabilities andfunctionalities of collector 140A.

Customization specification 300 includes information that describestypes of data to be collected and resources of target system 150 fromwhich the data it to be collected. For example, the customizationspecification may specify one or more of: one or more file types of datato be collected, the one or more target computer resources from whichthe data is to be collected, a time zone for collecting the data, a casename, a chunk size, an expiry date, a signature analysis indicator, aparse/compress indicator, a parse email indicator, one or more localdisks indicators, one or more removable disks indicators, or one or moremapped network shares indicators.

Customization specification 300 may specify that collected expirationdates for the files. The expiration dates may define a time periodduring which the requested files were created or updated. Customizationspecification 300 may also include case names to be used to identify thedata to be collected.

B. Examples of Customized Collectors

A customized collector is an executable program that is configured toperform data collection according to a customization specification. Acollector may be generated by deployment engine 130 according to thecustomization specification. Deployment engine 130 may store thecollector as collector 140A in cloud storage 140, and notify a custodianof workstation 151 in target system 150 that collector 140A is ready fordownloading onto target system 150.

Collector 140A may be configured to collect data and data files fromcomputer resources of target system 150, determine data formats andmedia for sending the collected data, and transmit the collected data inlogical containers that are compatible with the determined data formats.

Collector 140A may be configured to send notifications to users.Notification may include notifications to a custodian of target system150, notifications to deployment server 120, and/or notifications to auser of requestor computer 110.

As collector 140A is executed on target system 150, collector 140Acollects data, and stores the collected data in cloud storage 140. Theprocess of collecting data from target system 150 allows preserving theintegrity and security of the collected data because the data iscollected from target system 150 without interactions with users andowners of target system 150.

Storing the collected data may involve determining a format that issuited for transmitting and storing the collected data in cloud storage140. Selecting a suitable format may be viewed as determining a“container” in which the collected data and data files may be stored. Acontainer may be selected based on a variety factors, including, withoutlimitation, a size to the collected data, an available bandwidth, a sizeof target system 150, and a size of cloud storage 140.

Once a collection of data from target system 150 is completed, collector140A may generate an electronic communication and cause sending thecommunication to deployment server 120 and/or deployment engine 130. Thecommunication may include an indication that the data and/or data fileshave been collected and stored in cloud storage 140.

Collector 140A may be configured to receive requests for reportspertaining to the collected data. In response to receiving a request fora report, collector 140A may generate the requested report based on thecollected data, and provide the report to the requestor. The request maybe customized according to instructions included in the request. Theinstructions may be provided by the requestor via a graphical userinterface or on-a-fly.

V. Example Process for a Cloud-Based Data Collection

A process of requesting, collecting and storing data is performed by oneor more entities that communicate and exchange information with eachother. For example, a user of requestor computer 110 may generate arequest for performing a legal discovery on target system 150, andtransmit the request to deployment server 120. Based on the receivedrequest, deployment server 120 may generate a customizationspecification, and transmit the customization specification todeployment engine 130. Deployment engine 130 may generate a customizedcollector, and deploy the collector to cloud storage 140.

Deployment engine 130, or deployment server 120, may also send anotification to a custodian of target system 150 to provide informationabout the collector and instructions for downloading, installing andexecuting the collector. Deployment engine 130 may also transmit to thecustodian a unique, one-way key for accessing, downloading, andinstalling the collector. The key may be sent separately from theinstructions. Once the collector is downloaded onto target system 140,the collector is executed to collect the requested data. Once therequested data is collected, it is stored in cloud storage 140 ascollected data 140B. Collected data 140B may be encrypted, and ahyperlink to the encrypted, collected data may be provided to deploymentserver 120, or directly to requestor computer 110.

FIG. 4 is a block diagram that depicts an example approach forcollecting data from a target system using a customized, secure,cloud-based data collection tool. According to the depicted example, auser of requestor computer 110 generates a request to collect certaindata from target system 150. The request may be issued for any reason.For example, the request may be issued to execute a legal discovery.

The request may specify the type of data and data files to be collected,the time periods for which the data and data files are to be collected,computer resources of target system 150 from which the data and datafiles are to be collected, and the like. The user-provided requirementsare also referred to as collection definition data. The collectiondefinition data may be included in the request generated at requestorcomputer 110.

In step 402 of FIG. 4, the request is transmitted from requestorcomputer 110 to deployment server 120. The request may includecollection definition data containing the details of the request.Alternatively, the request may include one or more hyperlinks pointingto locations, at cloud storage 140, at which the collection definitiondata has been stored.

Upon receiving the request from requestor computer 110, deploymentserver 120 may analyze the request to identify the information includedin the request that can be used to generate a customizationspecification.

In step 404, deployment server 120 generates a customizationspecification. This may include extracting the information included inthe request received from requestor computer 110, and using theextracted information to generate the customization specification.

A customization specification may include information about file typesof data files to be searched, sources to be searched, indications ofwhether, or which, attachments are to be searched, and indicationswhether legal forms, such as court orders and other legal documents, areto be included in legal discovery. The customization specification mayalso include information about storage types that are to be searched,and storage locations that are to be searched. Furthermore, thecustomization specification may include user credentials, groupcredentials and other authentication information to be used by thecollector to perform data collection.

The customization specification may further include time constrains forperforming the legal discovery, types of processing, types ofmodifications (if any), methods for communicating results of the legaldiscovery, email addresses to be used by the collector and/or acustodian, types of notifications, error handling procedures, and thelike.

In step 406, deployment server 120 transmits the customizationspecification for generating the collector to deployment engine 130.

In step 408. deployment engine 130 generates the collector. The processof generating the collector is also referred to as compiling thecollector. The collector is customized according to the customizationspecification, and is customized to the specific resources of targetsystem 150. The process of generating the collector and characteristicsof the collector has been described above.

In step 412, deployment engine 130 stores the collector in cloud storage140. Deployment engine 130 determines the location, at cloud storage140, at which the collector has been stored. For example, deploymentengine 130 may determine a hyperlink to the location at which thecollector has been stored. The hyperlink to the location is transmittedto the custodian in step 414.

In step 416, deployment engine 130 generates a unique, one-time key foraccessing the collector. The key is going to be used by the custodian oftarget system 150 to access, download and install the collector ontarget system 150, and/or to initiate execution of the collector ontarget system 150. Deployment engine 130 transmits the key to thecustodian. Alternatively, the key may be generated and transmitted bydeployment server 120.

Deployment engine 130, or deployment server 120, may also transmit, tothe custodian, instructions for deploying the collector. Theinstructions may be sent in any form of a notification, such as anemail, a text, or a calendar invitation. The notification to thecustodian may be transmitted to notify a user of target system 150 thattarget system 150 is for example, in a litigation hold. The electronicmail may also indicate that a court order has been issued to collectdata and data files form target system 150. The email may also include acopy of the court order. The email may also include the hyperlink to thelocation at which the collector is stored. In addition to transmittingthe hyperlink, deployment engine 130 may also transmit to custodiancomputer 151 instructions for accessing the collector, unless suchinstructions have not been already transmitted to the custodian.

At this point, the custodian of target system 150 has received thenotification that the collection of some data from target system 150 hasbeen requested. The custodian has also received the hyperlink to thecollector, the instructions how to access the collector, and the uniquedeployment key.

In step 418, the custodian of target system 150 uses the uniquedeployment key to authenticate the custodian to the collector. Thecustodian may use the unique deployment key to authenticate to thecollector to start downloading the collector onto target system 150.

Assuming that the authentication was successful, the custodian, in step420, downloads the collector from cloud storage 140 onto computerresources of target system 150. Also in this step, the custodianinstalls the collector on target system 150, and initiates execution ofthe collector on target system 150.

In step 422, the collector is executed on target system 150 to collectdata from computer resources of target system 150. The data collectionis performed according to the customization specification embedded inthe collector. That includes collecting the particular types of datafrom the particular resources of target system 150, and storing thecollected data in the particular format in cloud storage 140.

Once collection of the requested data is completed, the collectorstores, in step 424, the collected data in cloud storage 140, or anyother storage resource available to, or managed by, cloud storage 140.Alternatively, the collected data may be transmitted (not depicted inFIG. 4) to deployment server 120, or to requestor computer 110.

Once the collected data is stored in cloud storage 140, cloud storage140 generates notifications to the interested parties. Although notdepicted in FIG. 4, the notifications may also be generated by thecollector as the collector finishes collecting the data. Thenotifications may be used to notify a user of deployment server 120 thatthe collection of the requested data has been completed and that therequested data have been stored in cloud storage 140. Upon receiving thenotification, the user of deployment server 120 may notify, in step 428,the requestor that the collection of the requested data has beencompleted and that the results have been stored.

Although not depicted in FIG. 4, a similar notification may betransmitted from cloud storage 140 directly to requestor computer 110 tonotify the requestor that the data collection task has been completed.

Upon receiving the notification, the requestor may access the collecteddata. The collected data may be exported from cloud storage 140 in avariety of formats. Non-limiting examples of the formats in which thecollected data and data files may be exported is the comma-separatedvalues (CSV) format. The CSV format may be implemented in a variety ofways, but usually it specifies that data records are to be concatenatedand each field of the data records be delimited using a comma. The CSVallows exporting tabular data between programs that natively operate onincompatible formats. The CSV is widely supported by a variety ofcomputer systems and devices. Other method of exporting the collecteddata and data files to cloud storage 140 may also be implemented.

In addition to sending the completion notifications, deployment server120 may provide the requestor with a data analysis and reporting tool.The tool may be equipped with a graphical user interface for requestingand generating reports pertaining to the data collection. The tool mayprovide the functionalities for generating a variety of charts depictingthe collected data, and the statistical information about the collecteddata. The functionalities may also include the functionalities forquerying the collected data, requesting different subsets of thecollected data, and performing data analysis on the subsets of thecollected data. The data analysis and reporting tool may be implementedas a software application hosted by a standalone system of deploymentserver 120, or as a software application executing on deployment server120.

The process of requesting, collecting, and storing data from targetsystem 150 may be repeated each time when deployment server 120 receivesa request for collecting data from target systems. The process may alsobe repeated when the collector is modified and redeployed. Moreover, theprocess may be repeated when collection definition data and/or acustomization specification is modified or when the collectionobjectives are changed.

VI. Example Workflow for a Cloud-Based Data Collection

FIG. 5 is a flow diagram that depicts an example approach for collectingdata from a target system using a customized, secure, cloud-based datacollection tool. The example approach depicted in FIG. 5 is to be viewedas one of many implementations of the cloud-based data collection toolpresented herein.

The depicted diagram shows deployment server 120 and target system 150.Deployment server 120 and target system 150 may communicate indirectly,as shown using indicators 582, 584 and 586. The indirect connectionbetween deployment server 120 and target system 150 may include, forexample, communications between deployment server 120 and deploymentengine 130, communications between deployment engine 130 and cloudsystem 140, and communications between cloud system 140 and targetsystem 150. These types of communications are depicted for example, inFIG. 1. Although not depicted in FIG. 5, deployment server 120 maycommunicate directly with target system 150.

Certain steps performed by deployment server 120 are performed inparallel with certain steps performed by target system 150. Theperformance of these steps may be synchronized in such a way that thecompletion of a particular step by deployment server 120 may trigger aparticular step to be performed by either a custodian computer 151 orthe collector executed on target system 150.

As depicted in FIG. 5, steps 502-516 are performed by deployment server120, steps 552-560 are performed by custodian computer 151, and steps570-574 are performed by the collector executed on target system 150.

In step 502, deployment server 120 receives a request for collectingdata. The request may include a name of the requestor, a name of theproject that the requestor is working on, and/or a name of theorganization or a party for whom the data collection is requested. Therequest may also include a name of the matter, and other informationrelated to the data collection. The request may also include informationabout a time zone in which the user, or the custodian, is located (fortimestamping the collected data), and one or more types of filecategories that the user wishes to have collected from target system150. The different types that may be provided in the request may includeactive files, archived files, database files, emails, empty files,encrypted files, file fragments, system files, financial data, filescontaining a particular font, form data, game data, graphics andmultimedia data, indexes, Internet files, and the like. The request mayalso provide information about file extensions of the data files thatare to be collected. Examples of different files extensions may includeDLT, DMD, DMF, DMG, DMP, and the like. The request may also specify oneor more system drives (or devices) hosted on target system 150 fromwhich the data is to be collected.

In step 504, deployment server 120 generates a customizationspecification based on the requirements included in the request.Examples of the customization specification are described in FIG. 3.

Also in this step, deployment server 120 transmits the customizationspecification to deployment engine 130.

In step 506, deployment server 120 causes deployment engine 130 togenerate the collector based on the customization specification. Thecustomization specification may include specifications of types of datato be collected, resources from which the data is to be collected,destinations at which the collected data is to be stored, types ofreports that are requested, and the like.

In step 508, deployment server 120 causes storing the collector incloud-based storage 140. Deployment engine 130 may for example, storethe collector at a particular location in cloud-based storage 140, andsave a hyperlink to the particular location.

In step 510, deployment server 120 causes sending the hyperlink to thecustodian of target system 150. This may be performed automatically oncethe collector is stored in cloud-based storage 140. Alternatively,deployment server 120 may send specific instructions to deploymentengine 130 to transmit the hyperlink to the custodian.

In step 512, deployment server 120 causes generating a unique, one-timedeployment key for accessing the collector. This may be performedautomatically once the collector is stored in cloud-based storage 140.Alternatively, deployment server 120 may send specific instructions todeployment engine 130 to generate the key, and to transmit the key tothe custodian. This step may be omitted if deployment server 120transmits the unique deployment key directly to the custodian andwithout any assistance from deployment engine 130.

In step 514, deployment server 120 tests whether it received anyindication that the requested data has been collected and stored incloud storage 140. For example, deployment server 120 may test whetherit received a notification from deployment engine 130, cloud storage140, or the collector itself, indicating that the data collection hasbeen completed and the collected data has been stored in cloud storage140. Alternatively, the notification may be received from target system150 when the execution of the collector is finished or terminated.

If deployment server 120 determined that the requested data has beencollected, then in step 516, deployment server 120 notifies therequestor that the requested data has been collected and stored in cloudstorage 140. Notifying the requestor may also include providing ahyperlink to the location at which the collected data is stored in cloudserver 140. This may also include providing encryption keys fordecrypting the stored, collected data if the data has been alreadyencrypted. Furthermore, this may include providing instructions foraccessing the stored, collected data, and instructions indicating howlong the stored data will be available in cloud storage 140.

However, if deployment server 120 does not receive a notification thatthe requested data has been collected and stored, then deployment server120 may continue waiting for the notification. Upon the expiration of acertain time period, deployment server 120 may generate a notificationto the requestor that the data collection was unsuccessful, and transmitthe notification to the requestor. Deployment server 120 may also sendan inquiry to the requestor to seek an indication from the requestorwhether to repeat execution of the collector on target system 150, orwhether to generate a new collector for collecting the data from targetsystem 150. In response to transmitting the inquiry to the requestor,deployment service 120 may receive a new request for generating a newcollector, or an indication for re-executing the already-generatedcollector.

The steps 502-516 may be repeated each time deployment server 120receives requests for collecting data from target systems.

Steps 552-560 are performed by custodian computer 151, while steps570-574 are performed by the collector executed on target system 150.

In step 552, custodian computer 151 of target system 150 receives thehyperlink to the location at which the collector is stored in cloudstorage 140. Depending on the implementation, the custodian may receivethe hyperlink directly from deployment engine 130 or from deploymentserver 120. The custodian may use the received hyperlink to access thecollector stored in cloud storage 140.

In step 554, custodian computer 151 receives the unique deployment keyfor accessing the collector stored in cloud system 150. Depending on theimplementation, the custodian may receive the unique deployment keydirectly from deployment engine 130 or from deployment server 120. Thecustodian may use the unique deployment key to access the collector.

In step 556, custodian computer 151 uses the unique deployment key toaccess the collector. For example, the custodian may invoke a webbrowser on custodian computer 151, and use the Web browser that allowsthe custodian to provide the hyperlink and the unique deployment key.Upon receiving the unique deployment key from the custodian, cloudstorage 140 may verify whether the provided key is a valid key foraccessing the collector. If the authentication is successful, then thecustodian downloads the collector onto target system 150, installs thecollector on target system 150, and initiates execution of thecollector. However, if the authentication is unsuccessful, then cloudstorage 150 may generate an error message and communicate the errormessage to either deployment engine 130 or deployment server 120, orboth.

In step 558, it is assumed that the authentication was successful. Inthis step, the custodian downloads the collector onto target system 150.Also in this step, the collector is installed on a custodian's computer,or the resources of target system 150. For example, the collector may beinstalled on custodian computer 151 or any other device of target system150 depicted in FIG. 1.

In step 560, the custodian initiates execution of the collector ontarget system 150. This may include collecting the particular data fromthe particular resources of target system 150. Details of the datacollection are described in FIG. 1.

In step 570, the collector is executed, and the requested data iscollected and stored in cloud storage 140. The collected data may beencrypted to provide security to the data collection process.

Once the execution of the collector is finished, the collector isterminated in step 572. This may be performed automatically as thecollector completes the data collection. Alternatively, this may beperformed upon receiving a request from the custodian or upon anexpiration of a certain time period.

In step 574, a notification is generated to indicate that the datacollection has been completed and that the collected data has beenstored in cloud storage 140. The notification may be generated by thecollector itself before the collector is terminated, or by the custodianupon receiving an indication that the data collection has beencompleted. The notification may be transmitted from target system 150 todeployment server 120, or to deployment engine 130, which then maycommunicate the notification to deployment server 120. Upon receivingthe notification, deployment server 120 may transmit the notification tothe requestor who requested the data to be collected.

Upon receiving the notification that the data collection has beencompleted, the requestor may display the collected data, and/or generatereports about the collected data. The reports generated based on thecollected data may be exported using different data formats. Forexample, a report may be formatted in accordance with the CSV format,described above.

VII. Benefits of Certain Embodiments

In an embodiment, an approach is presented for collecting electronicdata from target systems for the purpose of performing data discoveries,including legal discoveries and audit requests. Collecting theelectronic data is performed in a customized manner, which allowscollecting only the requested data and data files, and not all data fromall computer resources of the target systems.

Collecting the data is secure because access to a customized collectorrequires providing a unique deployment key, and because the collecteddata is encrypted and compressed.

The approach allows storing the collected data in any network storagesystem, including cloud systems hosted in a distributed network ofservers.

Furthermore, the approach allows preserving the integrity and securityof the collected data. For example, the approach allows performing thedata collection independently and without an actual involvement of thedata users or the data collection requestor.

The approach may be implemented in a system that can be accessedautomatically and without demonstrating any specialized knowledge orexperience in performing a data collection.

The presented approach also utilizes a robust, data analysis andreporting tool that allows generating various reports based on thecollected data. The reports may be customized in many different ways,and provide the functionalities to fine tune the results of thecollected data.

VIII. Implementation Mechanisms

Although the flow diagrams of the present application depict aparticular set of steps in a particular order, other implementations mayuse fewer or more steps, in the same or different order, than thosedepicted in the figures.

According to one embodiment, the techniques described herein areimplemented by one or more special-purpose computing devices. Thespecial-purpose computing devices may be hard-wired to perform thetechniques, or may include digital electronic devices such as one ormore application-specific integrated circuits (ASICs) or fieldprogrammable gate arrays (FPGAs) that are persistently programmed toperform the techniques, or may include one or more general purposehardware processors programmed to perform the techniques pursuant toprogram instructions in firmware, memory, other storage, or acombination. Such special-purpose computing devices may also combinecustom hard-wired logic, ASICs, or FPGAs with custom programming toaccomplish the techniques. The special-purpose computing devices may bedesktop computer systems, portable computer systems, handheld devices,networking devices or any other device that incorporates hard-wiredand/or program logic to implement the techniques.

FIG. 6 is a block diagram that depicts an example computer system 600upon which embodiments may be implemented. Computer system 600 includesa bus 602 or other communication mechanism for communicatinginformation, and a processor 604 coupled with bus 602 for processinginformation. Computer system 600 also includes a main memory 606, suchas a random-access memory (RAM) or other dynamic storage device, coupledto bus 602 for storing information and instructions to be executed byprocessor 604. Main memory 606 also may be used for storing temporaryvariables or other intermediate information during execution ofinstructions to be executed by processor 604. Computer system 600further includes a read only memory (ROM) 608 or other static storagedevice coupled to bus 602 for storing static information andinstructions for processor 604. A storage device 610, such as a magneticdisk or optical disk, is provided and coupled to bus 602 for storinginformation and instructions.

Computer system 600 may be coupled via bus 602 to a display 612, such asa cathode ray tube (CRT), for displaying information to a computer user.Although bus 602 is illustrated as a single bus, bus 602 may compriseone or more buses. For example, bus 602 may include without limitation acontrol bus by which processor 604 controls other devices withincomputer system 600, an address bus by which processor 604 specifiesmemory locations of instructions for execution, or any other type of busfor transferring data or signals between components of computer system600.

An input device 614, including alphanumeric and other keys, is coupledto bus 602 for communicating information and command selections toprocessor 604. Another type of user input device is cursor control 616,such as a mouse, a trackball, or cursor direction keys for communicatingdirection information and command selections to processor 604 and forcontrolling cursor movement on display 612. This input device typicallyhas two degrees of freedom in two axes, a first axis (e.g., x) and asecond axis (e.g., y), that allows the device to specify positions in aplane.

Computer system 600 may implement the techniques described herein usingcustomized hard-wired logic, one or more ASICs or FPGAs, firmware and/orprogram logic or computer software which, in combination with thecomputer system, causes or programs computer system 600 to be aspecial-purpose machine. According to one embodiment, those techniquesare performed by computer system 600 in response to processor 604executing one or more sequences of one or more instructions contained inmain memory 606. Such instructions may be read into main memory 606 fromanother computer-readable medium, such as storage device 610. Executionof the sequences of instructions contained in main memory 606 causesprocessor 604 to perform the process steps described herein. Inalternative embodiments, hard-wired circuitry may be used in place of orin combination with software instructions to implement the embodiments.Thus, embodiments are not limited to any specific combination ofhardware circuitry and software.

The term “computer-readable medium” as used herein refers to any mediumthat participates in providing data that causes a computer to operate ina specific manner. In an embodiment implemented using computer system600, various computer-readable media are involved, for example, inproviding instructions to processor 604 for execution. Such a medium maytake many forms, including but not limited to, non-volatile media andvolatile media. Non-volatile media includes, for example, optical ormagnetic disks, such as storage device 610. Volatile media includesdynamic memory, such as main memory 606. Common forms ofcomputer-readable media include, for example, a floppy disk, a flexibledisk, hard disk, magnetic tape, or any other magnetic medium, a CD-ROM,any other optical medium, a RAM, a PROM, and EPROM, a FLASH-EPROM, anyother memory chip or memory cartridge, or any other medium from which acomputer can read.

Various forms of computer-readable media may be involved in carrying oneor more sequences of one or more instructions to processor 604 forexecution. For example, the instructions may initially be carried on amagnetic disk of a remote computer. The remote computer can load theinstructions into its dynamic memory and send the instructions over atelephone line using a modem. A modem local to computer system 600 canreceive the data on the telephone line and use an infra-red transmitterto convert the data to an infra-red signal. An infra-red detector canreceive the data carried in the infra-red signal and appropriatecircuitry can place the data on bus 602. Bus 602 carries the data tomain memory 606, from which processor 604 retrieves and executes theinstructions. The instructions received by main memory 606 mayoptionally be stored on storage device 610 either before or afterexecution by processor 604.

Computer system 600 also includes a communication interface 618 coupledto bus 602. Communication interface 618 provides a two-way datacommunication coupling to a network link 620 that is connected to alocal network 622. For example, communication interface 618 may be anintegrated service digital network (ISDN) card or a modem to provide adata communication connection to a corresponding type of telephone line.As another example, communication interface 618 may be a local areanetwork (LAN) card to provide a data communication connection to acompatible LAN. Wireless links may also be implemented. In any suchimplementation, communication interface 618 sends and receiveselectrical, electromagnetic or optical signals that carry digital datastreams representing various types of information.

Network link 620 typically provides data communication through one ormore networks to other data devices. For example, network link 620 mayprovide a connection through local network 622 to a host computer 624 orto data equipment operated by an Internet Service Provider (ISP) 626.ISP 626 in turn provides data communication services through theworld-wide packet data communication network now commonly referred to asthe “Internet” 628. Local network 622 and Internet 628 both useelectrical, electromagnetic or optical signals that carry digital datastreams.

Computer system 600 can send messages and receive data, includingprogram code, through the network(s), network link 620 and communicationinterface 618. In the Internet example, a server 630 might transmit arequested code for an application program through Internet 628, ISP 626,local network 622 and communication interface 618. The received code maybe executed by processor 604 as it is received, and/or stored in storagedevice 610, or other non-volatile storage for later execution.

In the foregoing specification, embodiments have been described withreference to numerous specific details that may vary from implementationto implementation. Thus, the sole and exclusive indicator of what is,and is intended by the applicants to be, the approach is the set ofclaims that issue from this application, in the specific form in whichsuch claims issue, including any subsequent correction. Hence, nolimitation, element, property, feature, advantage or attribute that isnot expressly recited in a claim should limit the scope of such claim inany way. The specification and drawings are, accordingly, to be regardedin an illustrative rather than a restrictive sense.

What is claimed is:
 1. One or more non-transitory computer-readablestorage media storing instructions which, when processed by one or moreprocessors, cause: receiving a request to perform a data collection onone or more target computer resources; wherein the request includes oneor more requirements that are specific to the data collection to beperformed on the one or more target computer resources; based on, atleast in part, the one or more requirements, generating a customizationspecification for generating a customized collector that is specific tothe data collection to be performed on the one or more target computerresources; transmitting the customization specification to a deploymentengine to cause the deployment engine to: based on, at least in part,the customization specification, generate the customized collector thatis specific to the data collection to be performed on the one or moretarget computer resources; transmit the customized collector, forgenerating the customized collector, to a cloud storage; generate aunique deployment key that is specific to the customized collector;notify a custodian of the one or more target computer resources that theunique deployment key is provided to the custodian via one or moreparticular media; provide the unique deployment key to the custodian ofthe one or more target computer resources; and wherein, upon receivingthe unique deployment key, the unique deployment key is used by thecustodian to authenticate the custodian to the customized collector,and, in response to the custodian being successfully authenticated tothe customized collector, the customized collector is downloaded onto acustodian computer from the cloud storage and executed.
 2. The one ormore non-transitory computer-readable storage media of claim 1, whereinthe customization specification specifies one or more of: one or morefile types of data to be collected, the one or more target computerresources from which the data is to be collected, a time zone forcollecting the data, a case name, a chunk size, an expiry date, asignature analysis indicator, a parse/compress indicator, a parse emailindicator, one or more local disks indicators, one or more removabledisks indicators, or one or more mapped network shares indicators;wherein the one or more file types include one or more of: documentfiles, image files, spreadsheet files, attachments, system files, hiddenfiles, archive files, or email files; wherein one or more data files arecollected if their respective file signatures match any of the one ormore file types; and wherein a signature of a file is a unique codeembedded in the file.
 3. The one or more non-transitorycomputer-readable storage media of claim 1, storing additionalinstructions which, when executed by the one or more processors, causethe one or more processors to perform: causing the deployment engine todownload the customized collector to a collector computer and initiateexecution of the customized collector to perform the data collectionfrom the one or more target computer resources; and wherein execution ofthe customized collector to perform the data collection from the one ormore target computer resources includes collecting data that isspecified by the customization specification.
 4. The one or morenon-transitory computer-readable storage media of claim 1, wherein theone or more particular media include one or more of: an email, an audiomessage, or a letter.
 5. The one or more non-transitorycomputer-readable storage media of claim 1, storing additionalinstructions which, when executed by the one or more processors, causethe one or more processors to perform: determining whether performingthe data collection on the one or more target computer resources hasbeen finished; and in response to determining that performing the datacollection on the one or more target computer resources has beenfinished, generating a notification to a requestor who sent the requestto perform the data collection; and wherein the notification indicates alocation, in the cloud storage, at which results of the data collectionhave been stored.
 6. The one or more non-transitory computer-readablestorage media of claim 1, storing additional instructions which, whenprocessed by the one or more processors, cause: receiving a reportrequest; and in response to receiving the report request, accessing thedata stored in the cloud storage, and generating a report that presentsinformation about the data in a format specified by the report request.7. The one or more non-transitory computer-readable storage media ofclaim 1, wherein data collected by executing the customized collector isencrypted and compressed.
 8. A method for generating a customized,cloud-based data collection tool for collecting data from computerresources of a target system, the method comprising: receiving a requestto perform a data collection on one or more target computer resources;wherein the request includes one or more requirements that are specificto the data collection to be performed on the one or more targetcomputer resources; based on, at least in part, the one or morerequirements, generating a customization specification for generating acustomized collector that is specific to the data collection to beperformed on the one or more target computer resources; transmitting thecustomization specification to a deployment engine to cause thedeployment engine to: based on, at least in part, the customizationspecification, generate the customized collector that is specific to thedata collection to be performed on the one or more target computerresources; transmit the customized collector, for generating thecustomized collector, to a cloud storage; generate a unique deploymentkey that is specific to the customized collector; notify a custodian ofthe one or more target computer resources that the unique deployment keyis provided to the custodian via one or more particular media; providethe unique deployment key to the custodian of the one or more targetcomputer resources; and wherein, upon receiving the unique deploymentkey, the unique deployment key is used by the custodian to authenticatethe custodian to the customized collector, and, in response to thecustodian being successfully authenticated to the customized collector,the customized collector is downloaded onto a custodian computer fromthe cloud storage and executed.
 9. The method of claim 8, wherein thecustomization specification specifies one or more of: one or more filetypes of data to be collected, the one or more target computer resourcesfrom which the data is to be collected, a time zone for collecting thedata, a case name, a chunk size, an expiry date, a signature analysisindicator, a parse/compress indicator, a parse email indicator, one ormore local disks indicators, one or more removable disks indicators, orone or more mapped network shares indicators; wherein the one or morefile types include one or more of: document files, image files,spreadsheet files, attachments, system files, hidden files, archivefiles, or email files; wherein one or more data files are collected iftheir respective file signatures match any of the one or more filetypes; and wherein a signature of a file is a unique code embedded inthe file.
 10. The method of claim 8, further comprising: causing thedeployment engine to download the customized collector to a collectorcomputer and initiate execution of the customized collector to performthe data collection from the one or more target computer resources; andwherein execution of the customized collector to perform the datacollection from the one or more target computer resources includescollecting data that is specified by the customization specification.11. The method of claim 8, wherein the one or more particular mediainclude one or more of: an email, an audio message, or a letter.
 12. Themethod of claim 8, further comprising: determining whether performingthe data collection on the one or more target computer resources hasbeen finished; and in response to determining that performing the datacollection on the one or more target computer resources has beenfinished, generating a notification to a requestor who sent the requestto perform the data collection; and wherein the notification indicates alocation, in the cloud storage, at which results of the data collectionhave been stored.
 13. The method of claim 8, further comprising:receiving a report request; and in response to receiving the reportrequest, accessing the data stored in the cloud storage, and generatinga report that presents information about the data in a format specifiedby the report request.
 14. The method of claim 8, wherein data collectedby executing the customized collector is encrypted and compressed.
 15. Acomputer-implemented, deployment system for generating customizationspecifications for a customized collector, the computer-implemented,deployment system comprising: one or more hardware processors; one ormore memory units for storing computer instructions which, whenprocessed by the one or more hardware processors, cause the one or moreprocessors to perform: receiving a request to perform a data collectionon one or more target computer resources; wherein the request includesone or more requirements that are specific to the data collection to beperformed on the one or more target computer resources; based on, atleast in part, the one or more requirements, generating a customizationspecification for generating a customized collector that is specific tothe data collection to be performed on the one or more target computerresources; transmitting the customization specification to a deploymentengine to cause the deployment engine to: based on, at least in part,the customization specification, generate the customized collector thatis specific to the data collection to be performed on the one or moretarget computer resources; transmit the customized collector, forgenerating the customized collector, to a cloud storage; generate aunique deployment key that is specific to the customized collector;notify a custodian of the one or more target computer resources that theunique deployment key is provided to the custodian via one or moreparticular media; provide the unique deployment key to the custodian ofthe one or more target computer resources; and wherein, upon receivingthe unique deployment key, the unique deployment key is used by thecustodian to authenticate the custodian to the customized collector,and, in response to the custodian being successfully authenticated tothe customized collector, the customized collector is downloaded onto acustodian computer from the cloud storage and executed.
 16. Thecomputer-implemented, deployment system of claim 15, wherein thecustomization specification specifies one or more of: one or more filetypes of data to be collected, the one or more target computer resourcesfrom which the data is to be collected, a time zone for collecting thedata, a case name, a chunk size, an expiry date, a signature analysisindicator, a parse/compress indicator, a parse email indicator, one ormore local disks indicators, one or more removable disks indicators, orone or more mapped network shares indicators; wherein the one or morefile types include one or more of: document files, image files,spreadsheet files, attachments, system files, hidden files, archivefiles, or email files; wherein one or more data files are collected iftheir respective file signatures match any of the one or more filetypes; and wherein a signature of a file is a unique code embedded inthe file.
 17. The computer-implemented, deployment system of claim 15,storing additional instructions which, when executed by the one or moreprocessors, cause the one or more processors to perform: causing thedeployment engine to download the customized collector to a collectorcomputer and initiate execution of the customized collector to performthe data collection from the one or more target computer resources; andwherein execution of the customized collector to perform the datacollection from the one or more target computer resources includescollecting data that is specified by the customization specification.18. The computer-implemented, deployment system of claim 15, wherein theone or more particular media include one or more of: an email, an audiomessage, or a letter.
 19. The computer-implemented, deployment system ofclaim 15, storing additional instructions which, when executed by theone or more processors, cause the one or more processors to perform:determining whether performing the data collection on the one or moretarget computer resources has been finished; and in response todetermining that performing the data collection on the one or moretarget computer resources has been finished, generating a notificationto a requestor who sent the request to perform the data collection; andwherein the notification indicates a location, in the cloud storage, atwhich results of the data collection have been stored.
 20. Thecomputer-implemented, deployment system of claim 15, storing additionalinstructions which, when processed by the one or more processors, cause:receiving a report request; and in response to receiving the reportrequest, accessing the data stored in the cloud storage, and generatinga report that presents information about the data in a format specifiedby the report request.